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FOREWORD 


While  conflict  in  cyberspace  is  not  a  new  phenom¬ 
enon,  the  legality  of  hostile  cyber  activity  at  a  state  lev¬ 
el  remains  imperfectly  defined.  While  there  is  broad 
agreement  among  the  United  States  and  its  allies  that 
cyber  warfare  would  be  governed  by  existing  law  of 
armed  conflict,  with  no  need  for  additional  treaties 
or  conventions  to  regulate  hostilities  online,  this  view 
is  not  shared  by  many  nations  that  the  United  States 
could  potentially  face  as  adversaries. 

A  range  of  foreign  states  use  definitions  for  cyber 
conflict  that  are  entirely  different  from  our  own,  ex¬ 
tending  to  different  concepts  of  what  constitutes  on¬ 
line  hostilities  and  even  a  state  of  war.  This  leads  to 
a  potentially  dangerous  situation  where  an  adversary 
could  be  operating  according  to  an  entirely  different 
understanding  of  international  law  to  that  followed 
by  the  United  States. 

In  this  Letort  Paper,  Mr.  Keir  Giles  uses  Russian- 
language  sources  and  interviews  to  illustrate  the 
very  distinct  set  of  views  on  the  nature  of  conflict 
in  cyberspace  that  pertains  to  Russia.  He  provides 
an  important  window  into  Russian  thinking  and 
explains  how  fundamental  Russian  assumptions 
on  the  nature  of  cyber  activity  need  to  be  consid¬ 
ered  when  countering,  or  engaging  with,  Russian 
cyber  initiatives. 

The  Strategic  Studies  Institute  is  pleased  to  of¬ 
fer  this  detailed  analysis  as  an  essential  guide  to  the 
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mindset  of  an  important  cyber  actor,  and  one  which  it 
is  essential  for  the  United  States  to  understand. 


DOUGLAS  C.  LOVELACE,  JR. 
Director 

Strategic  Studies  Institute  and 
U.S.  Army  War  College  Press 
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SUMMARY 


The  United  States  and  its  allies  are  in  general 
agreement  on  the  legal  status  of  conflict  in  cyberspace. 
Although  key  principles  remain  unresolved,  such 
as  what  precisely  constitutes  an  armed  attack  or  use 
of  force  in  cyberspace,  overall  there  is  a  broad  legal 
consensus  among  Euro-Atlantic  nations  that  existing 
international  law  and  international  commitments  are 
sufficient  to  regulate  cyber  conflict. 

This  principle  is  described  in  multiple  authoritative 
legal  commentaries.  But  these  can  imply  misleadingly 
that  this  consensus  is  global  and  unchallenged.  In  fact, 
China,  Russia,  and  a  number  of  like-minded  nations 
have  an  entirely  different  concept  of  the  applicability 
of  international  law  to  cyberspace  as  a  whole,  includ¬ 
ing  to  the  nature  of  conflict  within  it.  These  nations 
could  therefore  potentially  operate  in  cyberspace  ac¬ 
cording  to  entirely  different  understandings  of  what 
is  permissible  under  international  humanitarian  law, 
the  law  of  armed  conflict,  and  other  legal  baskets  gov¬ 
erning  conduct  during  hostilities. 

U.S.  policymakers  cannot  afford  to  underestimate 
the  extent  to  which  Russian  concepts  and  approaches 
differ  from  what  they  may  take  for  granted.  This  in¬ 
cludes  the  specific  question  of  when,  or  whether,  hos¬ 
tile  action  in  cyberspace  constitutes  an  act  or  state  of 
war.  Recent  Russian  academic  and  military  commen¬ 
tary  stresses  the  blurring  of  the  distinction  between 
war  and  peace,  and  asks  to  what  extent  this  distinc¬ 
tion  still  exists.  This  suggestion  of  a  shifting  boundary 
between  war  and  peace  is  directly  relevant  to  consid¬ 
eration  of  at  what  point  Russia  considers  itself  to  be  at 
war  and  therefore  subject  to  specific  legal  constraints 
on  actions  in  cyberspace. 
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Conversely,  actions  that  are  considered  innocent 
and  friendly  by  the  United  States  and  European  na¬ 
tions  are  parsed  as  hostile  actions  by  Russia,  leading 
to  Russian  attempts  to  outlaw  "interference  in  another 
state's  information  space."  The  Russian  notion  of  what 
constitutes  a  cyber  weapon— or  in  Russian  terminol¬ 
ogy,  an  information  weapon— is  radically  different 
from  our  assumptions. 

Initiatives  put  forward  by  Russia  for  international 
cooperation  on  legal  initiatives  governing  cyber  activ¬ 
ity  have  received  a  mixed  response  from  other  states. 
But  they  need  to  be  taken  into  account  because  of  the 
alternative  consensus  on  cyber  security  opposing  the 
views  of  the  United  States  and  its  close  allies,  which  is 
growing  as  a  result  of  an  effective  Russian  program  of 
ticking  up  support  for  Moscow's  proposals  from  other 
countries  around  the  world. 

This  Letort  Paper  explores  the  Russian  approach 
to  legal  constraints  governing  actions  in  cyberspace 
within  the  broader  framework  of  the  Russian  under¬ 
standing  of  the  nature  of  international  law  and  com¬ 
mitments,  with  the  aim  of  informing  U.S.  military  and 
civilian  policymakers  of  views  held  by  a  potential 
adversary  in  cyberspace.  Using  a  Russian  perspec¬ 
tive  to  examine  the  legal  status  of  various  activities 
in  cyberspace,  including  what  constitutes  hostile 
activity,  demonstrates  that  assumptions  commonly 
held  in  the  United  States  may  need  to  be  adjusted 
to  counter  effectively  —  or  engage  with— Russian 
cyber  initiatives. 


LEGALITY  IN  CYBERSPACE: 
AN  ADVERSARY  VIEW 


INTRODUCTION 

The  United  States  and  its  allies  devote  consider¬ 
able  time  and  expense  to  considering  the  legal  dimen¬ 
sions  of  cyber  conflict.  Although  key  definitions  for 
establishing  legality  remain  unresolved,  such  as  what 
precisely  constitutes  an  armed  attack  or  use  of  force 
in  cyberspace,  the  legal  debates  within  and  between 
Euro-Atlantic  militaries  are  generally  in  harmony  and 
derive  from  a  broader  legal  consensus  in  these  na¬ 
tions.  This  consensus  holds  that  existing  international 
law  and  international  commitments  are  sufficient  to 
regulate  cyber  conflict,  and  furthermore  that  certain 
individual  rights  in  using  cyberspace  are  inalienable. 

Authoritative  legal  commentaries,  such  as  the  Tal¬ 
linn  Manual  on  the  International  Law  Applicable  to  Cyber 
Warfare,  released  in  early  2013, 1  reflect  this  Western 
consensus.  But  they  can  misleadingly  imply  that  this 
consensus  is  global  and  unchallenged.  Significantly, 
the  Manual  does  not  include  among  its  contributors 
any  legal  experts  from  nations  considered  potential 
adversaries  in  cyberspace,  notably  China  and  Russia. 

In  fact,  China,  Russia,  and  a  number  of  like-minded 
nations  have  an  entirely  different  concept  of  the  appli¬ 
cability  of  international  law  to  cyberspace  as  a  whole, 
including  to  the  nature  of  conflict  within  it.  These  na¬ 
tions  could  therefore  potentially  operate  in  cyberspace 
according  to  entirely  different  understandings  of  what 
is  permissible  under  international  humanitarian  law, 
the  law  of  armed  conflict,  and  other  legal  baskets  gov¬ 
erning  conduct  during  hostilities. 
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This  Letort  Paper  will  explore  the  Russian  approach 
to  legal  constraints  governing  actions  in  cyberspace, 
within  the  broader  framework  of  the  Russian  under¬ 
standing  of  the  nature  of  international  law  and  commit¬ 
ments,  to  inform  U.S.  military  and  civilian  policymak¬ 
ers  of  views  held  by  a  potential  adversary  in  cyberspace. 
It  will  examine  the  legal  status  of  activities  in  cyber¬ 
space,  including  what  constitutes  hostile  activity  from 
a  Russian  perspective,  to  demonstrate  that  assump¬ 
tions  commonly  held  in  the  United  States  may  need  to 
be  adjusted  effectively  to  counter  — or  engage  with  — 
Russian  cyber  initiatives. 

THE  CYBER  SECURITY  SCHISM 

In  conventional  conflict,  the  legal  constraints  on 
combatants  are  clearly  understood  and  well  defined. 
Precisely  when  and  how  a  state  of  war  arises  ( jus  ad 
helium)  and  how  parties  must  conduct  themselves  dur¬ 
ing  conflict  (jus  in  hello )  have  been  established  through 
customary  law  and  international  legal  commitments 
over  the  course  of  centuries.  Generally  accepted  among 
developed  nations,  these  principles  give  a  degree  of 
stability  and  predictability  to  the  extent  of  armed  con¬ 
flict,  particularly  in  terms  of  legal  constraints  on  col¬ 
lateral  damage,  proportionality,  initiation  of  conflict, 
self-defense,  and  humanitarian  impact. 

In  cyberspace,  no  such  consensus  exists.  This  is  be¬ 
cause  the  view  of  legality  held  by  the  United  States 
and  its  allies  is  not  a  global  one,  and  other  key  actors 
in  cyberspace  have  an  entirely  different  approach.  It 
is  therefore  important  for  U.S.  planners  to  understand 
that  potential  adversaries  may  be  operating  according 
to  an  entirely  different  set  of  assumptions  regarding 
what  is  permissible  behavior  in  cyberspace  in  terms  of 
international  law. 
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Descriptions  of  the  state  of  regulation  of  activity 
in  cyberspace  as  a  whole  are  replete  with  metaphor. 
Establishing  commonly  agreed  norms  and  rules  of 
behavior  for  this  new  domain  has  been  compared  to 
the  early  days  of  nuclear  weapons  with  no  mutual 
understanding  on  the  rules  of  deterrence,  to  the  mo¬ 
tor  car  with  no  rules  of  the  road,  to  the  long  devel¬ 
opment  of  international  maritime  law,  and  much  else 
besides.  A  common  perception  is  that  online  activity, 
and  in  particular  hostile  online  activity,  is  so  new  a 
phenomenon  that  there  should  be  little  surprise  that 
a  commonly  agreed  regulatory  framework  is  still  a 
distant  prospect. 

Despite  the  recent  burgeoning  of  domestic  and 
international  legal  debate  over  cyber  issues,  this  per¬ 
ception  of  novelty  is  misplaced.  Neither  cyber  conflict, 
nor  the  legal  arguments  over  it,  can  remotely  be  de¬ 
scribed  as  a  new  concept.  Among  newcomers  to  cy¬ 
ber  issues,  it  is  commonly  believed  that  the  notion  of 
introducing  hostile  code  custom  written  by  national- 
level  experts  into  a  secure  facility  on  removable  media 
in  order  to  carry  out  a  precisely  targeted  attack  on  a 
system  through  a  supervisory  control  and  data  acqui¬ 
sition  (SCAD A)  interface  is  an  entirely  new  and  origi¬ 
nal  idea  never  heard  of  before  Stuxnet.  Until,  that  is, 
they  see  the  original  British  version  of  The  Italian  ]ob, 
where  exactly  the  same  process  is  described  in  a  mo¬ 
tion  picture  released  almost  40  years  earlier.  As  stated 
by  Jason  Healey  in  his  survey,  "A  Fierce  Domain," 
which  should  be  essential  reading  for  anybody  who 
believes  that  this  is  a  new  issue: 
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Many  of  the  questions  vexing  cyber  policymakers 
today  were  asked  in  exactly  the  same  terms  by  their 
predecessors  10  and  20  years  earlier.  Again  and  again, 
lessons  have  been  identified  and  forgotten  rather  than 
learned.2 

Nevertheless,  despite  a  Euro-Atlantic  consensus  on 
the  broad  principles  of  cyber  conflict  and  use  of  the  In¬ 
ternet,  intense  debate  between  legal  practitioners  con¬ 
tinues,  with  a  marked  increase  in  intensity  following 
the  recent  prioritization  of  cyber  issues  in  the  United 
States  and  the  United  Kingdom  (UK),  and  associated 
funding  flows.  Examples  of  recent  legal  scholarship 
published  in  the  last  12  months  alone  include  "Legal 
Implications  of  Territorial  Sovereignty  in  Cyberspace" 
and  "Law  of  Neutrality  in  Cyberspace"  by  leading 
German  specialist  Wolff  Heintschel  Von  Heinegg;  "A 
Methodology  for  Cyber  Operations  Targeting  and 
Control  of  Collateral  Damage  in  the  Context  of  Lawful 
Armed  Conflict"  by  Robert  Lanelli;  studies  examining 
the  applicability  of  international  law  to  terrorist  acts 
committed  through  cyberspace;3  and  many  more. 

Yet  all  these  works,  as  well  as  the  Tallinn  Manual 
referred  to  previously,  reflect  only  a  portion  of  the 
global  debate  over  potential  cyber  law.  Studying  Rus¬ 
sian  scholarship  on  "information  warfare"  (IW)  and 
international  agreements  promoted  by  Russia  with 
varying  degrees  of  success  provides  an  entirely  dif¬ 
ferent  view.  Examination  of  the  Shanghai  Coopera¬ 
tion  Organization  (SCO)  Information  Security  Treaty 
of  2009,  or  the  draft  International  Code  of  Conduct 
in  Cyberspace  proposed  in  the  United  Nations  (UN) 
jointly  by  Russia,  China,  Tajikistan,  and  Uzbekistan  in 
2011,  illustrates  that  different  nations  hold  views  di¬ 
vergent  from  those  of  the  United  States. 
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One  key  area  of  disagreement  is  whether  online 
activity,  and  especially  online  conflict,  is  broadly  gov¬ 
erned  by  existing  international  law,  or  whether  en¬ 
tirely  new  legal  instruments  are  needed  to  govern  it. 
An  objective  assessment  by  two  authoritative  officers 
of  the  Organization  for  Cooperation  and  Security  in 
Europe  (OSCE)  notes  that  "no  universally  accepted  le¬ 
gal  framework  for  dealing  with  cyber  threats  exists."4 
This  leads  Russia,  China,  and  others  to  call  for  what 
Hamadoun  Toure,  head  of  the  International  Telecom¬ 
munication  Union  (ITU)  has  described  as: 

a  treaty  in  which  countries  would  promise  to  ensure 
Internet  access  for  their  citizens,  protect  them  from  at¬ 
tacks,  work  with  other  countries  to  stop  criminal  ac¬ 
tivities,  and  not  attack  another  country  first.5 

The  United  States,  by  contrast,  argues  that  no  such 
new  document  is  necessary.  The  result  is  what  Ger¬ 
man  academic  and  practitioner  Sandro  Gaycken  refers 
to  as  a  "stalemate  of  norms."6 

At  the  same  time,  the  international  information 
security  debate  has  long  been  characterized  by  mu¬ 
tual  blind  spots.  Unless  directly  engaged  with  Russia, 
China,  or  the  ITU,  many  in  the  United  States  and  al¬ 
lied  policy  or  academic  communities  remain  simply 
unaware  that  there  is  a  view  that  diverges  sharply 
from  the  one  they  are  accustomed  to. 

In  part,  this  is  because  of  the  striking  unanimity 
of  view  on  the  subject  among  English-speaking  na¬ 
tions,  where  it  is  hard  to  identify  any  divergence  in 
approach  and  underlying  assumptions  on  the  role  and 
nature  of  cyber  security.  This  deep  consensus  can  give 
rise  to  a  situation  where  even  those  experts  with  inter¬ 
national  exposure  can  overlook  the  fact  that  this  is  not 
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the  only  possible  view.  For  example,  attendees  at  the 
launch  of  the  Tallinn  Manual  referred  to  previously  at 
the  Royal  Institute  of  International  Affairs  (Chatham 
House)  in  London,  UK,  in  March  2013,  heard  the  fol¬ 
lowing  description  of  its  universal  acceptance:  "The 
U.S.,  the  UK,  the  EU  [European  Union],  and  NATO 
[North  Atlantic  Treaty  Organization]  all  agree.  Every¬ 
body  agrees"7— rather  overlooking  that  "everybody" 
includes  substantially  more  nations  with  a  very  differ¬ 
ent  approach  to  the  subject. 

The  broad  divide  between  those  states  and  orga¬ 
nizations  that  argue  that  new  international  law  is  re¬ 
quired  to  govern  cyberspace  and  cyber  conflict,  and 
those  that  are  satisfied  with  existing  law,  is  a  con¬ 
venient  tool  for  explaining  the  broad  sweep  of  the 
debate,  but  it  masks  complexities.  For  example,  the 
Russian  and  Chinese  approaches  to  the  problem  can 
appear  superficially  similar  —  sufficiently  so  for  Russia 
and  China  to  cooperate  on  drafting  the  "International 
Code  of  Conduct"  referred  to  previously.  But  within 
this  alternative  consensus,  there  are  nuances  and  vari¬ 
ations.  As  noted  by  Bertrand  de  La  Chapelle,  Direc¬ 
tor  of  the  Internet  &  Jurisdiction  Project  at  the  Inter¬ 
national  Diplomatic  Academy  in  Paris  and  a  Director 
on  the  Internet  Corporation  for  Assigned  Names  and 
Numbers  (ICANN)  Board,  although  the  debate  on 
Internet  governance: 

externally  resembles  an  institutional  battle  . . .  between 
institutions  progressively  put  in  place  to  ensure  the 
growth  of  internet  infrastructure,  including  ICANN, 
and  the  traditional  multilateral  system  of  the  United 
Nations  (UN)  and  its  specialized  agencies,  including 
the  International  Telecommunications  Union  (ITU).  . 

.  .  this  vision  is  dangerous  .  .  .  and  also  erroneous  and 
over-simplified.  The  approaches  of  the  various  actors 
are  infinitely  more  complex.8 
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For  this  reason,  the  Russian  approach  to  legality 
in  cyberspace  needs  to  be  considered  separately  from 
that  of  China,  the  SCO,  the  Collective  Security  Trea¬ 
ty  Organization,  or  any  other  state  or  organization 
whose  views  appear  at  first  sight  to  chime  with  the 
Russian  ones. 

Why  Cyber  Security  Is  Needed. 

In  order  to  assess  the  Russian  approach  to  what  is 
and  is  not  permissible  in  cyberspace,  it  is  essential  first 
to  deal  with  a  mismatch  of  fundamental  notions  of  cy¬ 
ber  security.  Even  before  we  approach  the  topic  of  ac¬ 
tual  cyber  conflict,  the  official  Russian  view  is  that  cy¬ 
ber  security  overall  is  not  about  defending  businesses 
and  people,  as  we  would  understand  it,  but  states  and 
territories.  So  to  understand  the  Russian  viewpoint, 
we  need  to  leave  behind  some  of  the  basic  assump¬ 
tions  and  principles  about  cyberspace  stated  by  Euro- 
Atlantic  governments. 

For  the  purpose  of  illustration,  we  can  avoid  well- 
known  U.S.  statements  on  cyber  security  and  instead 
take  Sweden  as  a  case  study.  According  to  Swedish 
Ministry  of  Foreign  Affairs  officials  from  the  Interna¬ 
tional  Law  and  Human  Rights  Department: 

We  analyze  internet  freedom  within  a  human  rights 
framework.  .  .  .  The  foundation  is  basic  human  rights 
law:  security  needs  to  be  arranged  so  as  not  to  violate 
human  rights  law  . . .  Information  security  is  to  protect 
the  individual,  not  governments.  It's  to  protect  you 
and  me.9 

This  notion  that  human  rights  are  a  fundamental 
concern  determining  how  the  Internet  should  be  man- 
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aged  contrasts  with  the  Russian  approach  voiced  in 
public  statements  that  security  is  an  essential  basis 
and  other  considerations  are  secondary.  In  fact,  as  will 
be  discussed  herein,  specific  activities  that  Sweden  en¬ 
courages  on  the  Internet  are  interpreted  by  Russia  as 
hostile  actions. 

Sweden  is  not  the  only  country  that  disagrees  with 
the  Russian  approach  that  security  trumps  all  other 
considerations  when  using  the  Internet.  The  UK  view 
is  that  economic  issues  are  the  foundation,  and  secu¬ 
rity  has  to  be  built  around  these:  "Cyber  is  first  about 
the  economy  and  prosperity.  National  security  and 
military  security  are  not  the  most  immediate  concerns 
there."10 

The  overall  UK  assumption  that  cyber  security  is 
"to  protect  the  individual,  not  governments"  overlaps 
with,  but  does  not  equate  to,  the  standard  Russian 
formulation  of  security  being  about  protection  of  the 
trinity  of  individual,  society,  and  state.11  As  will  be 
seen  in  repeated  examples  throughout  this  Letort  Pa¬ 
per,  this  balance  of  interests  in  the  Russian  perception 
leads  to  a  highly  distinctive  Russian  approach  to  what 
is  permissible  and  legal  in  cyberspace. 

THE  EURO-ATLANTIC  CONSENSUS 

What  follows  is  not  a  qualified  legal  opinion,  but 
rather  refers  to  a  number  of  existing  analyses  to  de¬ 
scribe  a  general  consensus.  This  will  provide  context 
and  contrast  for  the  description  of  the  Russian  ap¬ 
proach  that  follows. 
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Cyber  Warfare  and  International  Law. 

Many  current  legal  debates  in  the  United  States 
and  allied  countries  over  conflict  in  cyberspace  cen¬ 
ter  on  the  definition  of  an  "armed  attack"  or  "use  of 
force,"  and  how  these  definitions  can  be  extended 
into  cyberspace.  This  is  because  Article  2(4)  of  the  UN 
Charter  prohibits  the  threat  or  use  of  force  (undefined) 
against  the  territorial  integrity  or  political  indepen¬ 
dence  of  any  state  — except  (Article  51)  in  cases  of  self- 
defense  against  an  armed  attack  (also  undefined).  The 
lack  of  clarity  over  what  constitutes  an  armed  attack 
in  cyberspace  raises  complications  in  other  spheres  as 
well,  such  as  its  use  in  the  North  Atlantic  Treaty  as  a 
criterion  for  collective  action  by  NATO. 

Thus  there  is  a  basic  gap  in  fundamental  defini¬ 
tions  for  deciding  what  is,  and  is  not,  legal  in  cyber 
warfare.  According  to  one  detailed  analysis  of  the 
existing  law  governing  cyber  conflict: 

Right  now,  no  comprehensive  international  treaty 
exists  to  regulate  cyber  attacks.  Consequently,  states 
must  practice  law  by  analogy:  either  equating  cyber 
attacks  to  traditional  armed  attacks  and  responding  to 
them  under  the  law  of  war  or  equating  them  to  crimi¬ 
nal  activity  and  dealing  with  them  under  domestic 
criminal  laws.12 

But  this  is  considered  broadly  satisfactory.  Cus¬ 
tomary  international  law  has  come  to  take  the  view 
that  armed  attack  requires  a  certain  intensity,  and  a 
response  in  self-defense  requires  necessity  and  pro¬ 
portionality.  Anticipatory  self-defense  is  based  on  im¬ 
minence,  but  the  burden  of  proof  lies  with  the  actor 
that  responds  in  self-defense.  Thus  the  lack  of  absolute 
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definition  of  hostile  activity  in  cyberspace  does  not  ex¬ 
onerate  a  state  that  has  acted  in  a  hostile  manner: 

Every  internationally  wrongful  act  by  a  State  gives 
rise  to  international  responsibility.  .  .  .  Conduct  con¬ 
sisting  of  an  action  or  omission  is  imputed  to  a  State 
under  international  law.  .  .  .  The  basis  of  state  respon¬ 
sibility  will  vary  with  the  content  of  the  international 
obligation.  This  may  be  a  strict  basis  or  the  basis  of 
risk  in  some  circumstances,  while  in  others  it  may  in¬ 
volve  malice  or  culpable  negligence,  or,  conceivably, 
malice.13 

So,  it  is  argued: 

States  have  a  right  under  international  law  to:  1.  View 
and  respond  to  cyber  attacks  as  acts  of  war  and  not 
solely  as  criminal  matters.  2.  Use  active,  not  just  pas¬ 
sive,  defenses  against  the  computer  networks  in  other 
states,  that  may  or  may  not  have  initiated  an  attack, 
but  have  neglected  their  duty  to  prevent  cyber  attacks 
from  within  their  borders.14 

This  latter  point  addresses  an  issue  long  thought  con¬ 
tentious  in  cyberspace,  namely  responsibility  for  the 
actions  of  nonstate  actors.  In  fact,  nonstate  actors  who 
carry  out  hostile  actions  against  foreign  states  (par¬ 
ticularly  relevant  in  the  case  of  Russia)  are  also  pro¬ 
vided  for  by  existing  legal  obligations.  According  to 
one  analysis: 

Since  it  is  not  realistic  to  expect  states  to  completely 
prevent  armed  attacks  by  non-state  actors,  the  disposi¬ 
tive  factor  in  evaluating  state  conduct  is  what  a  state 
does  to  address  potential  threats  and  whether  it  takes 
realistic  steps  to  prevent  the  attack  from  occurring.15 
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States  have  a  longstanding  duty  to  prevent  non¬ 
state  actors  from  using  their  territory  to  commit  cross- 
border  attacks.  Traditionally,  this  duty  only  required 
states  to  prevent  illegal  acts  that  the  state  knew  about 
beforehand.  However,  this  duty  has  evolved  in  re¬ 
sponse  to  international  terrorism  and  now  requires 
states  to  act  against  groups  generally  known  to  carry 
out  illegal  acts.  In  the  realm  of  cyber  warfare,  this 
duty  should  be  interpreted  to  require  states  to  enact 
and  enforce  criminal  laws  to  deter  cross-border  cyber 
attacks.  This  means  that: 

Either  states  will  live  up  to  their  duty  and  start  enforc¬ 
ing  criminal  laws  against  attackers,  or  states  will  vio¬ 
late  their  duty,  which  will  create  a  legal  pathway  for 
victim-states  to  hold  them  legally  responsible  for  an 
attack  without  having  to  attribute  it  first.  In  effect,  re¬ 
peated  failure  by  a  state  to  take  criminal  action  against 
its  attackers  will  result  in  it  being  declared  a  'sanctu¬ 
ary  state/  allowing  other  states  to  use  active  defens¬ 
es  against  cyber  attacks  originating  from  within  its 
borders.16 

By  extension,  another  highly  contentious  issue, 
that  of  positive  attribution  of  hostile  cyber  activity  to 
identify  the  perpetrator  and  take  appropriate  respon¬ 
sive  action  against  the  correct  target,  is  also  addressed 
partially  addressed  in  the  case  of  nonstate  actors: 

It  is  evident  that  victim-states  may  forcibly  respond  to 
armed  attacks  by  non-state  actors  located  in  another 
state  when  host-states  violate  their  duty  to  prevent 
those  attacks.  With  cyber  attacks,  imputing  state  re¬ 
sponsibility  in  this  manner  provides  states  a  legal  path 
to  utilize  active  defenses  without  having  to  conclu¬ 
sively  attribute  an  attack  to  a  state  or  its  agents.17 
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In  short,  if  a  state  "looks  the  other  way  when  cyber 
attacks  are  conducted  against  rival  states,  it  effectively 
breaches  its  duty  to  prevent  them  through  its  unwill¬ 
ingness  to  do  anything  to  stop  them,  just  as  if  it  had 
approved  the  attacks."18 

At  the  same  time,  in  order  for  Law  of  Armed  Con¬ 
flict  (LOAC)  to  apply  to  a  particular  conflict,  neither 
formal  declaration  of  war  nor  recognition  of  a  state 
of  war  is  required.  According  to  a  detailed  analysis 
of  the  legal  status  of  cyber  activity  during  the  armed 
conflict  in  Georgia  in  2008,  this  was  subject  to  the  re¬ 
quirements  of  LOAC  "as  from  the  actual  opening  of 
hostilities."19  An  analysis  of  ethics  applicable  to  cyber 
warfare  agrees: 

Because  the  principle  of  forfeiture  determines  permis¬ 
sible  responses  to  all  interpersonal  harm,  the  point  at 
which  kinetic  and  cyber-attacks  constitute  a  just  cause 
or  casus  belli  is  the  same.20 

and  continues  by  describing  further  analogies  that  can 
determine  a  casus  belli: 

On  the  one  hand,  a  person  attempting  or  actively  in¬ 
tending  to  murder  through  a  series  of  harms  known 
to  be  individually  non-lethal  but  lethal  in  aggregate  is 
liable  to  lethal  force.  On  the  other  hand,  successive  cy¬ 
ber-intrusions  that  combine  to  merely  weaken  a  state 
militarily  and/or  economically  do  not  in  themselves 
constitute  a  just  cause  for  war.21 

As  can  be  seen,  the  legal  debate  is  complex  and  mul¬ 
tifaceted.  By  contrast,  one  Russian  argument  is  that 
efforts  should  be  made  not  to  regulate  cyber  warfare, 
but  to  outlaw  it  altogether. 
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RUSSIAN  VIEWS 


In  contrast  to  the  common  Western  view  of  the 
Internet  as  an  enabler  and  facilitator,  many  Russian 
analysts,  experts,  and  commentators  are  guided  by 
a  much  better  established  perception  of  insecurity 
online,  and  a  greater  openness  to  considering  the  In¬ 
ternet  as  a  vulnerability  as  well  as  an  opportunity. 
The  Russian  intelligence  services  publicly  stress  the 
potential  for  a  detrimental  effect  on  national  security 
arising  from  connection  to  the  Internet.22  According  to 
Associate  Professor  of  the  Faculty  of  Electronic  War¬ 
fare  of  the  Russian  Combined-Arms  Academy  Pavel 
Antonovich,  not  only  does  Russia  risk  seeing  a: 

negative  effect  on  how  its  national  interests  are  safe¬ 
guarded  [resulting  from]  improvements  in  the  form  of 
unlawful  activity  in  the  cybernetic  . . .  area,  and  in  high 
technologies"— but  these  technologies  themselves  are 
a  threat.23  Other  authoritative  writers  in  the  presti¬ 
gious  "Military  Thought"  journal  stress  not  only  the 
asymmetric  effect  of  cyber  attack  on  Russia  — 

The  information  infrastructures  of  major  powers  such 
as  the  U.S.  or  the  Russian  Federation  could  be  wrecked 
hopelessly  by  a  single  battalion  of  600  "cyber  fighters" 
after  two  years  of  training  for  a  cyber  attack  and  no 
more  than  $100  million  in  costs.24 

Antonovich  concluded  by  summarizing  the  impact 
on  society  and  the  state  as  a  whole,  over  and  above 
our  preoccupation  with  the  direct  effect  on  specific 
targets: 

The  damage  done  by  cyber  weapons  may  include 
man-made  disasters  at  vital  industrial,  economic, 
power,  and  transportation  facilities,  financial  collapse. 


13 


and  systemic  economic  crisis.  Besides,  cyber  weapons 
can  cause  government  and  military  operations  to  spin 
completely  out  of  control,  leave  the  population  de¬ 
moralized  and  disorientated,  and  set  off  widespread 
panic.25 

The  alarm  voiced  by  the  security  services  is  not  a 
new  concern  that  has  arrived  with  the  rise  of  social 
media,  but  a  persistent  narrative  since  the  first  pub¬ 
lic  debates  on  the  subject  in  the  mid-1990s,  when  the 
Internet  as  a  whole  was  described  by  the  Federal  Se¬ 
curity  Service  (FSB,  Russian  secret  police)  as  a  threat 
to  Russian  national  security.  A  consistent  argument 
since  that  time  has  been  that  Russian  connection  to 
the  "world  information  space  ...  is  impossible  with¬ 
out  the  comprehensive  resolution  of  the  problems  of 
information  security."26  More  recently,  the  perception 
of  vulnerability  to  hostile  activity  using  the  medium 
of  the  Internet  has  become  ever  more  acute:  as  argued 
in  2012,  "this  is  not  an  empty  scare  — the  cyberspace 
warfare  is  already  on."27 

This  perception  of  vulnerability  lends  even  greater 
weight  to  the  habitual  Russian  emphasis  on  interna¬ 
tional  law  being  the  essential  framework  underpin¬ 
ning  all  international  activity.28  This  accent  on  the  pri¬ 
macy  of  law  is  typically  much  more  prominent  than  in 
U.S.  and  allied  statements,  and  although  it  does  rest 
on  a  distinctive  view  of  the  nature  of  international 
law,29  it  also  in  part  explains  the  Russian  persistence  in 
seeking  new  international  legal  instruments  govern¬ 
ing  cyberspace. 

The  Russian  argument  for  a  new  "Convention  on 
International  Information  Security,"  which  would 
also  govern  aspects  of  what  we  would  describe  as 
cyber  warfare,  has  been  exhaustively  deconstructed 
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elsewhere.30  The  remainder  of  this  section  will  ex¬ 
amine  the  underlying  Russian  ideas  and  preconcep¬ 
tions  that  illustrate  points  of  divergence  from  U.S. 
and  Euro-Atlantic  approaches.  This  will  be  done  in 
three  distinct  areas:  domestic  application  of  existing 
law;  the  military  approach;  and  the  results  for  how 
Russia's  international  legal  initiatives  are  presented 
and  received. 

Domestic  Application. 

There  is  a  widespread  perception  outside  Russia 
that  Internet  use  there  is  heavily  censored,  and  that 
freedom  of  expression  is  suppressed  as  a  result  of  a 
misguided  and  paranoid  view  among  the  Russian  se¬ 
curity  services  that  free  speech  constitutes  a  threat  to 
the  ruling  regime.  As  always,  the  real  picture  is  more 
complex  and  nuanced. 

An  example  of  the  distinctive  nature  of  the  Rus¬ 
sian  approach,  and  the  security  considerations  behind 
it,  comes  with  the  use  of  social  media.  Emphasis  on 
freedom  of  expression  as  a  human  right  causes  some 
foreign  observers  to  suffer  an  allergic  reaction  when 
exposed  to  official  Russian  statements  that  appear 
to  call  for  regulation  of  expression  on  social  media. 
These  statements,  while  they  may  appear  entirely 
rational  within  context,  are  received  overseas  in  an 
environment  in  which  freedom  of  expression  is  sac¬ 
rosanct,  and  which  finds  it  inconceivable  that  social 
media,  as  a  means  of  that  expression,  can  be  subject  to 
restriction. 

This  conviction  is  so  deep  that  some  nations  take 
upon  themselves  a  mission  to  assist  this  free  expres¬ 
sion  in  other  countries,  regardless  of  whether  this  is  in 
accordance  with  those  countries'  national  law.  Return- 
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ing  to  the  case  of  Sweden,  20  percent  of  the  Swedish 
overseas  development  budget  is  spent  on  "capacity 
building/  democracy  support"  —  including  "provid¬ 
ing  tools  needed  to  communicate  successfully"  in 
repressive  environments  and  "providing  encryption 
software  for  activists"  to  ensure  this  communication 
remains  concealed  from  the  national  government  and 
law  enforcement  authorities.31 

This  is  precisely  the  kind  of  interference  in  another 
state's  "information  space"  that  Russia  views  as  hostile 
and  wishes  to  proscribe  through  international  agree¬ 
ments  like  the  "Convention"  referenced  previously. 
At  a  UN  disarmament  conference  in  2008,  a  Russian 
Ministry  of  Defence  representative  suggested  that  any 
time  a  government  promoted  ideas  on  the  Internet 
with  the  intention  of  subverting  another  country's 
government,  including  in  the  name  of  democratic  re¬ 
form,  this  would  qualify  as  "aggression"  and  an  inter¬ 
ference  in  internal  affairs.32  Yet  at  the  same  time,  this 
is  not  construed  by  Sweden  as  a  hostile  act.  According 
to  Carl  Fredrik  Wettermark  of  the  International  Law 
and  Human  Rights  Department,  Swedish  Ministry  of 
Foreign  Affairs  (MFA),  "there  is  no  tension  between 
democracy  support  — including  encryption  and  com¬ 
munications  provision  — and  working  with  the  gov¬ 
ernments  that  the  activists  are  opposing."33 

This  fundamental  contradiction  arises  in  part 
because  of  an  almost  total  lack  of  threat  perception 
arising  from  social  media  among  the  Euro-Atlantic 
community.  Fortunately,  a  case  study  is  available  to 
demonstrate  why  Russia  and  other  nations  are  con¬ 
cerned  over  misuse  of  social  media  — or  why,  as  ex¬ 
pressed  by  Major  General  Aleksey  Moshkov  of  the 
Russian  Ministry  of  Internal  Affairs  in  late  2011,  "so¬ 
cial  networks,  along  with  advantages,  often  bring  a 
potential  threat  to  the  foundations  of  society."34  This  is 
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the  case  of  the  uprising  and  civil  war  in  Libya,  where 
social  media  and  online  communication  circumvent¬ 
ing  government  control  played  a  key  role  in  regime 
change.  According  to  a  study  published  by  the  U.S. 
Naval  War  College: 

Successful  dispute  of  the  government  control  of  com¬ 
munications  led  to  freedom  of  action  in  the  cyber  and 
land  domains.  This  freedom  of  action  led  to  traditional 
military  support  from  the  U.S.  and  NATO  that  ulti¬ 
mately  allowed  the  opposition  to  achieve  the  physi¬ 
cal  objectives  of  defeating  the  Gaddafi  regime  and  the 
eventual  election  of  a  new  government.35 

Translated  to  the  context  of  Russian  security  con¬ 
cerns,  this  correlates  to  statements  like  the  one  by  FSB 
First  Deputy  Director  Sergei  Smirnov  in  early  2012: 
"New  technologies  are  used  by  Western  secret  servic¬ 
es  to  create  and  maintain  a  level  of  continual  tension 
in  society  with  serious  intentions  extending  even  to 
regime  change."36 

The  view  that  political  change  in  North  Africa  after 
the  Arab  Spring  came  about  as  a  result  of  a  Western 
IW  and  cyber  conspiracy,  which  could  then  be  imple¬ 
mented  against  Russia,  fed  into  suspicion  of  foreign 
orchestration  at  the  time  of  Russia's  election  protests 
in  2011-12,  and  was  subsequently  vindicated  by  anal¬ 
yses  (like  the  one  mentioned  previously)  of  the  role  of 
social  media  in  the  Libyan  civil  war  — which  showed 
that  they  can  be  used  not  only  for  the  espionage, 
subversion,  and  circumvention  of  communications 
restrictions  suspected  by  Russia's  security  services,37 
but  also  for  other  instruments  of  regime  change,  up  to 
and  including  supplying  targeting  information  for  air- 
strikes.38  Assessment  of  Russian  concerns  over  "mis¬ 
use"  of  social  media  needs  to  be  placed  in  the  context 
of  this  perception  of  existential  threat. 
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A  complicating  factor  that  hinders  understanding 
of  the  official  Russian  attitude  to  the  legality  of  domes¬ 
tic  Internet  use  is  that  policy  statements  on  this  and 
other  issues  differ  widely  depending  on  their  source, 
giving  rise  to  yet  more  incomprehension  abroad.  Of¬ 
ficials  from  bodies  including  the  MFA,  the  Ministry 
of  Internal  Affairs,  the  Ministry  of  Communications, 
the  FSB,  the  Security  Council,  and  the  Presidential  Ad¬ 
ministration  (the  latter  two,  voiced  through  their  aca¬ 
demic  offshoots,  the  Institute  of  Information  Security 
Issues  and  the  Russian  Institute  for  Strategic  Studies, 
respectively)  make  pronouncements  that  rightly  or 
wrongly  are  seen  as  voicing  official  Russian  govern¬ 
ment  policy,  and  which  are  mutually  contradictory. 
For  this  reason  and  others,  commercial  entities  in 
Russia  and  those  following  the  topic  overseas  eagerly 
await  the  promised  release  of  a  new  cyber  security 
strategy,  which  should  clarify  at  least  some  of  the 
more  controversial  issues. 

When  Russian  proposals  are  reviewed  overseas,  a 
further  perceived  incompatibility  arises  between  Rus¬ 
sian  initiatives  for  international  action  on  cyber  secu¬ 
rity  and  Russia's  own  bad  reputation  as  a  permissive 
environment  for  cyber  crime.  A  book  published  in 
2011  stated  that: 

Given  the  strength  of  .  .  .  comprehensive  surveillance 
of  the  Internet,  one  might  assume  that  Russia  would 
represent  an  implacably  hostile  environment  for  cyber 
criminals.  Yet  the  Russian  Federation  has  become  one 
of  the  great  centers  of  global  cybercrime.  The  strike 
rate  of  the  police  is  lamentable,  while  the  number  of 
those  convicted  barely  reaches  double  figures. 

The  reason,  while  unspoken,  is  largely  understood. 
Russian  cyber  criminals  are  free  .  .  .  provided  the  tar- 
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get  of  [their]  attacks  are  located  in  Western  Europe 

and  the  United  States.39 

This  statement  appeared  entirely  uncontroversial 
because  of  a  relative  lack  of  publicity  for  recent  Rus¬ 
sian  efforts  against  cyber  crime  and  the  high  profile  of 
commercial  entities,  as  opposed  to  law-enforcement 
agencies,  in  combating  crime.  The  impression  abroad 
persists,  therefore,  that  there  has  been  no  change  in 
the  (at  the  very  least)  permissive  attitude  to  cyber 
crime  and  to  other  forms  of  antisocial  behavior  online, 
including  the  activities  of  "patriotic  hackers"  carrying 
out  destructive  and  criminal  activity  in  foreign  states 
such  as  Estonia  and  Georgia,  activity  that  happens  to 
coincide  with  the  Russian  state  aims  of  the  day.  In¬ 
deed,  Russia's  perceived  unwillingness  to  prosecute 
cyber  crime  against  overseas  targets  has  been  put  for¬ 
ward  as  a  serious  and  plausible  explanation  for  the 
concurrent  unwillingness  to  join  the  Budapest  Con¬ 
vention  on  Cybercrime.40 

The  department  of  Russia's  Ministry  of  Internal 
Affairs  that  deals  with  cyber  crime  is  referred  to  as 
"Directorate  K."  Russia  was  slow  to  legislate  against 
computer  crime,  and  this  department  is,  to  some  ex¬ 
tent,  still  hampered  by  inadequate  and  outdated  leg¬ 
islation.  Colonel  General  (Retired)  Boris  Nikolayevich 
Miroshnikov,  the  cultured  and  softly  spoken  first  com¬ 
mander  of  Directorate  K,  explains  that  "our  laws  are 
not  keeping  up  with  the  problems  we  are  observing.  . 
.  .  [W]e  are  the  victims  of  our  civil  legal  regulation  not 
keeping  up.41 

In  part,  he  says,  this  results  from  pursuing  the 
economic  benefits  of  the  Internet  while  disregarding 
security  concerns  —  echoing  criticism  by  other  Russian 
commentators  of  the  Western  approach  to  use  of  the 
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Internet.  In  addition,  the  pace  of  developing  new  laws 
is  simply  unable  to  keep  up  with  the  development  of 
activity  in  cyberspace.  "An  event  has  to  become  a  phe¬ 
nomenon,  then  we  have  to  study  it,  then  legislate  — 
but  we  are  in  a  legal  lacuna  between  the  old  and  new 
laws,"  Miroshnikov  says.42  The  result  is  palpable  frus¬ 
tration  at  the  balance  of  legislation  governing  online 
activity,  with  officials  citing  the  example  of  banks  that 
have  been  victims  of  cyber  crime  responding  to  re¬ 
quests  for  information  with  the  aim  of  assisting  them, 
with  a  detailed  legal  explanation  of  why  this  informa¬ 
tion  cannot  be  given  due  to  legislation  on  commercial 
secrecy  and  protection  of  personal  data.  The  situation 
is  complicated  still  further  by  competition  between 
Russian  law  enforcement  agencies,  investigators,  and 
prosecutors,  a  situation  referred  to  by  Boris  Mirosh¬ 
nikov  as  "departmental  egoism."43 

New  laws  governing  Internet  usage  have  recently 
been  passed  in  Russia.  These  laws  tend  to  attract  criti¬ 
cism  from  abroad.  Both  a  July  2013  law  on  protection 
of  intellectual  property  online,  and  the  July  2012  "In¬ 
ternet  blacklist"  law  setting  up  a  "Single  Register"  of 
websites  blocked  because  they  are  deemed  threatening 
to  minors,  have  been  painted  by  activists  and  foreign 
media  as  state  efforts  to  introduce  Internet  censorship 
on  ostensibly  economic  and  moral  grounds  —  includ¬ 
ing,  potentially,  censorship  of  social  media  outlets.44 
But  it  is  misleading  to  present  these  laws  solely  as 
an  initiative  intended  to  stifle  political  dissent.  They 
also  variously  meet  international  and  domestic  com¬ 
mercial  obligations,  and  reflect  a  desire  to  preserve 
some  elements  of  Russian  cultural  norms.  Many  more 
proposals  for  doing  so  have  been  raised  in  the  Rus¬ 
sian  legislative  bodies  but  fallen  flat  on  the  grounds 
of  impracticality,  such  as  a  draft  law  that  would  have 
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outlawed  foul  language  on  the  Internet.45  The  sugges¬ 
tion  that  legislation  has  been  introduced  at  the  request 
of  President  Putin  to  suppress  dissent  is  undermined 
by  the  continuing  proliferation  of  sometimes  quite 
mordant  anti-Putin  satire  online.46 

Detailed  assessments  of  the  impact,  intended  and 
unintended,  of  legislative  initiatives  is  provided  by 
the  Russian  Association  for  Electronic  Communica¬ 
tions  (RAEC),  an  industrial  body  that  provides  expert 
evaluations  for  draft  laws  and  provides  a  voice  for  the 
Internet  industry  in  shaping  the  regulatory  picture.47 
These  assessments  can  differ  markedly  from  the  some¬ 
times  overblown  rhetoric  of  rights  organizations  and 
overseas  media  when  discussing  the  same  legislation. 

In  addition,  fears  of  sweeping  powers  to  remove 
offending  content  from  the  Internet,  if  not  misplaced, 
are  perhaps  mistimed:  these  powers  were  already 
available  to  the  Russian  authorities  through  legal  and 
regulatory  routes.  Under  the  Federal  law  "On  Police" 
dated  2011,  Internet  service  providers  can  be  instruct¬ 
ed  to  shut  down  an  Internet  resource  on  suspicion  of 
providing  "conditions  which  assist  the  commission  of 
a  crime  or  administrative  violation,"  with  no  require¬ 
ment  for  the  police  to  seek  a  court  order.  According 
to  Russian  domain  name  regulations,  "the  Registrar 
may  terminate  the  domain  name  delegation  on  the 
basis  of  a  decision  in  writing"  by  a  senior  law  enforce¬ 
ment  official  —  again,  with  no  requirement  for  judicial 
oversight.48 

Despite  allegations  that  the  Single  Register  has 
been  used  to  censor  or  stifle  views  critical  of  the  gov¬ 
ernment,  the  loudest  criticism  comes  from  those  who 
note  that  it  is  a  blunt  instrument  whose  flawed  imple¬ 
mentation  has  serious  unintended  consequences  —  for 
instance,  blocking  YouTube  because  a  zombie  make- 
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up  instruction  video  is  wrongly  identified  as  pro¬ 
moting  self-harm,  or  rendering  Russia's  most  popu¬ 
lar  search  engine,  Yandex,  unavailable  for  almost  30 
minutes  in  late  April  2013  due  to  its  being  accidentally 
added  to  the  Register.49 

These  criticisms  are  often  directed  at  the  Minis¬ 
try  of  Communications,  as  the  body  with  ultimate 
supervisory  authority  for  the  Register.  The  Ministry 
response,  far  from  the  hard  line  that  critics  of  Russia 
often  assume,  is  that  it  is  asking  the  Internet  industry 
to  self-regulate,  and  the  Single  Register  is  a  mecha¬ 
nism  for  this  — and  furthermore,  the  Ministry  should 
not  be  blamed,  as  it  is  only  implementing  a  Federal 
law  rather  than  its  own  regulations. 

It  follows  that  the  nature  of  control  of  freedom  of 
expression  online  in  Russia  is  more  subtle  and  nu- 
anced  than  the  heavy-handed  censorship  often  de¬ 
scribed  overseas,  and  it  would  be  misleading  to  claim 
that  the  sole  aim  of  recent  legal  initiatives  is  to  sup¬ 
press  dissent.50  At  the  same  time,  the  fundamentally 
different  Russian  approach  to  the  balance  of  rights 
and  responsibilities  online  remains.  The  head  of  the 
Russian  MFA's  Department  of  New  Challenges  and 
Threats  (which,  naturally,  includes  cyber)  —  and  Rus¬ 
sia's  cyber  ambassador  — is  Andrey  Vladimirovich 
Krutskikh.  In  his  view,  the  primacy  of  freedom  of 
speech  that  is  promoted  by  Western  powers  is  a  form 
of  "extremism,"  and  its  damaging  potential  is  in¬ 
compatible  with  freedom  of  access  to  the  Internet.51 
Krutskikh  uses  the  example  of  Boston  police  request¬ 
ing  social  media  users  not  to  broadcast  police  activi¬ 
ties  in  the  aftermath  of  the  Boston  marathon  bombing 
in  April  201352  to  bolster  his  argument  for  the  need  to 
regulate  freedom  of  expression  in  the  interests  of  na¬ 
tional  security.53  Thus  the  distinctive  official  Russian 
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view  of  cyber  security  continues  to  be  informed  by  a 
perception  of  threat  from  the  Internet,  and  of  the  bal¬ 
ance  of  interest  there,  which  is  at  odds  with  our  own. 

Military  Views. 

According  to  the  former  head  of  the  Russian  Gen¬ 
eral  Staffs  Main  Operations  Directorate,  Lieutenant 
General  Andrey  Tretyak,  there  are  now  four  "spaces 
for  high-technology  confrontation  — space,  land,  air, 
and  information."54  When  considering  Russian  ap¬ 
proaches  to  cyber,  it  is  essential  to  remember  the  dif¬ 
ferent  dividing  lines  between  information  operations 
and  computer  network  operations  that  pertain  to  Rus¬ 
sian  thinking,  and  the  resulting  references  to  "infor¬ 
mation  space"  rather  than  cyberspace.55 

Russian  writing  in  open  sources  on  the  likely  na¬ 
ture  of  online  confrontation  —  including,  for  example, 
the  Conceptual  Views  on  the  Activity  of  the  Russian  Fed¬ 
eration  Armed  Forces  in  Information  Space,  a  document 
widely  seen  as  the  Russian  military's  cyber  proto¬ 
doctrine  —  rarely  fail  to  refer  to  the  need  to  observe  le¬ 
galities.  For  example,  a  2012  essay  on  military  thought 
regarding  rules  and  principles  governing  this  kind 
of  conflict: 

If,  however,  a  conflict  heats  up  to  a  critical  point,  the 
Russian  Armed  Forces  will  exercise  their  right  to  in¬ 
dividual  or  collective  self-defense  and  resort  to  any 
methods  and  weapons  they  choose,  as  long  as  they 
comply  with  the  commonly  accepted  norms  and  prin¬ 
ciples  of  international  law.56 
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Yet  over  and  above  the  issue  of  a  specific  Russian 
interpretation  of  existing  international  law,  there  is 
also  the  consideration  of  at  what  point  Russia  consid¬ 
ers  itself  to  be  at  war  and  therefore  subject  to  jus  in  hel¬ 
lo.  Recent  Russian  commentary  stresses  the  blurring 
of  the  distinction  between  war  and  peace,  and  asks  to 
what  extent  this  distinction  still  exists.  Antonovich, 
cited  previously,  argues  that  cyberspace  erodes  this 
line  and  holds  that  actions  in  cyberspace  are  allowed 
without  crossing  the  line  to  war.  Significantly,  he  ar¬ 
gues  that  damaging  cyber  attacks  can  be  carried  out 
without  a  state  of  war  existing  or  being  triggered  by 
the  attack: 

Dividing  lines  between  war  and  peace  can  be  eroded 
conveniently  in  cyberspace.  Damage  (whatever  its 
nature)  can  actually  be  done  to  an  adversary  with¬ 
out  overstepping  formally  the  line  between  war  and 
peace.57 

This  suggestion  of  a  shifting  boundary  between 
war  and  peace  is  not  restricted  to  academic  circles: 
the  same  idea  was  voiced  by  Chief  of  General  Staff 
Valeriy  Gerasimov  when  he  contended  at  a  speech 
for  the  Academy  of  Military  Sciences  that  the  states 
of  war  and  peace  are  now  more  of  a  continuum  than 
distinct,  and  that  new  types  of  conflict  other  than  war 
can  have  political  results  comparable  to  war.58 

Gerasimov's  argument  is  worth  studying  in  detail, 
not  only  for  its  possible  implications  for  cyber  conflict, 
but  also  for  understanding  Russia's  approach  to  the 
use  of  armed  force  overall.  The  new  continuum  of 
conflict  is  explained  in  detail  by  Vladimir  Makhonin, 
a  Russian  historian  who  describes  a  hierarchy  of  con¬ 
flict  where  war  is  the  ultimate  stage  but  is  preceded  by 
armed  conflict,  which  in  its  turn  is  preceded  by  social 
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conflict  (defined  as  resolving,  by  a  variety  of  means, 
extreme  differences).  In  other  words,  social  conflict 
and  armed  attack  take  their  place  as  a  stage  of  con¬ 
frontation  that  do  not,  according  to  this  view,  amount 
to  war.59 

The  implications  of  this  for  cyber  conflict  are  two¬ 
fold.  First,  any  full-scale  cyber  conflict  would,  just 
as  with  conventional  armed  conflict,  be  preceded  by 
smaller-scale  attacks: 

It  may  be  safely  assumed  that  a  large-scale  external 
aggression  aimed  at  seizing  Russia's  resources  will  be 
preceded  by  a  series  of  conflicts  (not  necessarily  armed 
ones)  within  the  country.  Increasing  activity  by  various 
terrorist,  ethnic  separatist,  extremist  and  other  similar 
organizations  will  become  a  species  of  reconnaissance 
in  force  as  the  situation  ripens  for  a  large-scale  war. 
Historical  experience  suggests  that  this  kind  of  sce¬ 
nario  is  only  too  feasible.60 

Second,  hostile  information  activity,  including 
computer  network  operations,  can  be  conducted  out¬ 
side  a  state  of  war.  According  to  an  exceptional  study 
of  Russian  views  on  information  operations  and  IW 
by  Sweden's  Defence  Research  Agency  (FOI): 

Regarding  network  and  computer  operations  in  peace¬ 
time  IW,  viruses  and  other  malware  are  important  in 
order  to  compromise  the  information  assets  of  the  en¬ 
gineering  systems  of  the  enemy.  Other  aspects  of  IW 
are  accumulating  (stealing)  information  on  the  enemy, 
by  intelligence  gathering,  while  developing  and  test¬ 
ing  one's  own  IW  weapons.61 

This  is  a  departure  from  previous  Russian  views 
of  the  status  of  information  warfare.  In  the  mid-1990s, 
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leading  experts  Timothy  L.  Thomas  and  Lester  Grau 
were  able  to  write  that: 

.  .  .  from  a  military  point,  the  view  of  Information 
Warfare  against  Russia  or  its  armed  forces  will  cat¬ 
egorically  not  be  considered  a  non-military  phase  of 
a  conflict  whether  it  will  be  causalities  or  not .  .  .  con¬ 
sidering  the  possible  catastrophic  use  of  information 
warfare  means  by  an  enemy,  whether  on  economic  or 
state  command  and  control  systems,  or  on  the  combat 
potential  of  the  armed  forces.  .  .  .  Russia  retains  the 
right  to  use  nuclear  weapons  first  against  the  means 
and  forces  of  information  warfare,  and  then  against 
the  aggressor  state  itself.62 

Three  further  specific  features  of  current  Russian 
views  on  when  cyber  force  can  legitimately  be  used 
need  to  be  briefly  considered.  First,  there  is  the  nature 
of  the  threat  perceived  by  Russia,  its  radical  difference 
from  Western  threat  perception,  and  its  pervasive 
influence  on  decisionmaking.  As  noted  by  Stephen 
Blank  and  others,  "We  often  underestimate  the  impact 
of  the  Russian  leadership's  perception  that  Russia  is 
intrinsically  at  risk,  and  in  some  sense  under  attack 
from  the  West."63  Second,  and  related  to  the  first,  there 
is  Russian  awareness  of  a  capability  gap  with  the 
threatening  West,  and  the  consequent  need  to  respond 
asymmetrically.  Norwegian  analyst  Tor  Bukkvoll 
writes  that: 

The  idea  of  developing  an  asymmetric  technological 
response  —  popular  in  many  nations  with  more  or  less 
strained  relations  with  the  West— has  become  a  truism 
among  the  Russian  traditionalists.  The  main  reason  is 
the  realization  that  the  Western  lead  is  too  great  to 
catch  up  with.64 
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Indeed,  according  to  Vladimir  Putin,  Russia's 
responses  to  threats  "are  to  be  based  on  intellectual 
superiority.  They  will  be  asymmetrical,  and  less  cost¬ 
ly."65  Third,  there  is  the  distinctive  Russian  perception 
of  its  relations  with  its  smaller  neighbors  —  including 
those  that  are  commonly  held  to  have  been  targets  of 
Russian  cyber  attacks,  Estonia  and  Georgia.  A  separate 
Norwegian  study  of  Russian  attitudes  to  the  use  of 
force  was  published  in  2005,  before  any  widely  publi¬ 
cized  cyber  aggression  was  ascribed  to  Russia.  But  its 
conclusion  regarding  conventional  intervention  is  just 
as  valid  for  cyber:  "It  can  be  argued  that  Russian  deci¬ 
sionmakers  simply  did  not  consider  the  former  Soviet 
republics  foreign  in  terms  of  cases  of  intervention."66 

International  Initiatives. 

Russia  has  persistently  sought  a  new  international 
legal  instrument  that  would  constrain  activity  in  cy¬ 
berspace.  The  desire  for  this  is  driven  by  consider¬ 
ations  described  previously,  including  threat  percep¬ 
tion,  emphasis  on  the  primacy  of  international  law, 
and  a  Russian  desire  to  constrain  competitors  by  po¬ 
litical  means  while  in  a  state  of  vulnerability  arising 
from  a  capability  gap.67  There  is  also  the  traditional 
debate  over  the  relative  weight  of  the  capabilities  or 
the  intentions  of  potential  adversaries.  For  Andrey 
Krutskikh,  the  answer  is  clear:  "Imagine  that  120-130 
countries  acquire  the  capability  for  cyber  strikes  — 
then  the  strikes  will  inevitably  follow."68  This  section 
will  not  list  specific  points  of  the  Russian  proposals, 
as  this  has  been  done  in  detail  elsewhere:69  instead,  it 
looks  at  how  they  are  presented  and  received,  and  the 
implications  of  this  for  the  United  States  and  its  allies. 
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There  is  an  apparent  paradox  that  some  widely 
accepted  international  agreements  are  already  avail¬ 
able,  but  not  subscribed  to  by  Russia.  This  is  because, 
as  drafted,  they  contain  clauses  that  are  unacceptable 
to  the  Russian  authorities.  As  noted  by  OSCE  experts 
Raphael  Perl  and  Nemanja  Malisevic,  some  states  do 
have  legitimate  objections  to  clauses  in  instruments 
such  as  the  Council  of  Europe's  Convention  on  Cyber¬ 
crime  2001  (the  Budapest  Convention):  "in  reality  .  .  . 
many  states  face  challenges  in  becoming  party  to  these 
conventions."70 

Initiatives  put  forward  by  Russia  for  international 
cooperation  in  information  security  have  received  a 
mixed  response  from  other  states.  In  particular,  over 
a  period  of  years  they  have  been  consistently  ignored 
or  rejected  by  the  United  States,  the  UK,  and  other 
like-minded  nations.  This  response  is  indicative  of 
the  huge  remaining  divide  between  the  views  and  as¬ 
sumptions  expressed  in  these  Russian  initiatives  and 
the  Euro-Atlantic  presumptions,  which  are  taken  for 
granted  by  many  of  those  reading  them.71 

Experts  involved  in  discussions  with  Russia,  or 
analysis  of  their  proposals,  are  able  to  engage  in  de¬ 
bate  over  their  specific  provisions,  their  acceptability 
to  the  United  States  and  allies,  and  their  practicality 
or  otherwise.  But  remember  that  this  international 
group  with  exposure  to  both  sides  of  the  argument 
is  only  a  very  small  subset  of  the  much  larger  group 
of  individuals  engaged  with  the  issues  as  a  whole. 
Many  more  officials,  diplomats,  policymakers,  and 
advisers  in  Western  nations  will  only  be  acquainted 
with  their  own  side  of  the  debate.  The  reaction  to  Rus¬ 
sian  statements,  actions,  and  policy  initiatives  from 
this  group  can  include  words  like:  unpredictable, 
unnecessarily  uncooperative,  incomprehensible,  and 
frequently,  irrational. 
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In  part,  this  is  because  of  the  relative  lack  of  visibil¬ 
ity  abroad  of  key  Russian  proposals.  Opportunities  to 
bring  the  Russian  ideas  to  broader  notice  appear  often 
not  to  be  taken.  We  can  take  as  an  example  the  Bu¬ 
dapest  Conference  on  Cyberspace  in  October  2012,  on 
the  face  of  it  a  prime  venue  for  explaining  the  Russian 
point  of  view  to  the  world.  Ahead  of  the  conference, 
"International  Cyber  Documents"  were  provided  for 
reference  on  its  website,  outlining  national  and  inter¬ 
national  approaches  to  cyber  security  — for  example, 
the  text  of  a  speech  by  Swedish  Foreign  Minister  Carl 
Billet,  Australian  and  Canadian  white  papers  and  cy¬ 
ber  security  strategies,  the  Budapest  Convention  on 
Cybercrime,  OECD  recommendations,  and  NATO 
statements.  Yet  no  Russian  equivalent  was  provided.72 
During  the  conference  itself,  just  as  at  the  London 
Conference  on  Cyberspace  the  previous  year,  a  pre¬ 
sentation  delivered  in  Russian  failed  to  account  for 
interpretation  and  therefore  failed  to  put  across  key 
points  at  which  the  Russian  view  diverged  from  the 
Euro-Atlantic  consensus  on  the  nature  of  the  Inter¬ 
net  and  rights  and  obligations  in  cyberspace.  It  was 
for  this  reason,  among  others,  that  many  observers 
experienced  considerable  surprise  when  this  consen¬ 
sus  came  face  to  face  with  the  rest  of  the  world  at  the 
World  Conference  on  International  Telecommunica¬ 
tions  (WCIT)  in  Dubai  in  December  2012. 

A  key  lesson  from  WCIT  for  those  who  had  not 
been  following  the  debate  was  the  extent  of  support 
for  the  viewpoint  championed  by  Russia  from  those 
countries  that  share  similar  concerns  about  the  cyber 
threat.  Although  Russian  initiatives  have  been  mostly 
discounted  or  ignored  in  the  West,  this  is  not  their 
only  audience,  and  Russia  has  been  busy  gathering 
support  from  other  countries  not  usually  considered 
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cyber  powers,  but  with  a  perfectly  valid  vote  in  fora 
such  as  the  ITU  or  the  UN.  This  is  possible  because 
while  many  of  the  proposals  appear  counterintuitive, 
outdated,  unworkable,  or  otherwise  unacceptable  to 
a  Western  audience,  they  appear  comforting  and  rea¬ 
sonable  in  parts  of  the  world  that  see  a  potential  threat 
in  the  unrestricted  circulation  of  information,  includ¬ 
ing  hostile  and  damaging  information,  both  domesti¬ 
cally  and  internationally. 

At  the  same  time,  while  many  of  the  proposals  for 
international  agreement,  and  the  assumptions  about 
the  nature  of  the  Internet  that  underlie  them,  are  in 
direct  conflict  with  how  the  Euro-Atlantic  community 
understands  the  Internet  to  work,  they  also  conflict 
with  the  understanding  of  Russian  Internet  authori¬ 
ties  themselves  at  a  working  level.  For  instance,  a  key 
principle  of  the  Russian  proposals  is  the  concept  of  na¬ 
tional  information  space  under  state  control.  But  this 
is  not  compatible  with  the  work  of  Russian  Internet 
service  providers  and  domain  authorities,  unrelated 
to  the  state,  who  ensure  the  free  circulation  of  infor¬ 
mation  across  borders  on  a  daily  basis,  because  this  is 
a  fundamental  feature  of  the  Internet.  As  stated  on  the 
website  of  the  Russian  Internet  Governance  Forum 
(RIGF),  which  took  place  in  late  April  2013: 

UHTepHeT  MBJiMeTCM  Ha;  iyocyi  i,apcTBe  h  h  hi  iyt  o6pa- 
30BaHweM  m,  a,e-  cjaaiero,  He  nivteeT  rpaHwn,.  14  mchho 
noaTOMy  a Jifl  HHTepHeTa  Tax  riouxouuT  ivioaejib  koji- 
jieKTHBHoro  ynpaBjieHHM  CeTbio  (t.h.  MyjibTHCTefiK- 
XOJ[,Hepi43M) 

(The  internet  is  a  supra-governmental  entity,  and  de 
facto  has  no  borders.  It  is  for  this  reason  that  the  model 
of  collective  governance  [so-called  multistakehold- 
erism]  is  so  suitable  for  the  internet.)73 
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This  is  in  direct  contradiction  to  some  key  prin¬ 
ciples  of  Russian  initiatives  at  a  political  level. 

The  points  mentioned  thus  far  create  an  unforgiv¬ 
ing  environment  for  positive  reception  of  Russia's 
ideas  on  the  nature  and  purpose  of  cyber  security, 
and  they  contribute  to  the  lack  of  meaningful  debate 
on  what  precisely  those  ideas  are.  This  leads  to  their 
rejection,  either  instinctive  or  reasoned,  by  Western 
liberal  readers.  Russia's  proposed  Draft  Convention 
on  International  Information  Security,  as  well  as  the 
International  Code  of  Conduct  proposed  by  Russia 
and  other  states  in  the  UN,  are  the  latest  iteration  of 
longstanding  proposals  but  remain  unacceptable  to 
the  Euro-Atlantic  community. 

In  fact,  as  explained  by  a  Nordic  diplomat  speak¬ 
ing  anonymously,  some  states  deliberately  avoid  any 
use  of  the  term  "information  security"  in  official  state¬ 
ments  because  of  its  negative  associations;  even  if  the 
phrase  is  the  most  appropriate  one  to  describe  the 
topic  under  discussion,  it  has  been  sufficiently  tainted 
by  association  with  the  regulatory  stance  adopted  by 
Russia  and  China  in  particular,  that  it  is  shunned  in 
favor  of  the  more  acceptable  "cyber  security."  Mean¬ 
while,  official  representatives  of  other  states  that  are 
deeply  cautious  about  naming  specific  states  as  cyber 
security  offenders  overall  can  casually  refer  to  Russia 
and  China  as  the  "worst  adversaries" —not  in  cyber 
conflict,  but  in  discussion  over  human  rights.74 

At  a  public  level,  examples  abound  of  a  total  fail¬ 
ure  to  achieve  not  just  dialogue,  but  also  the  level  of 
mutual  comprehension  that  would  be  its  essential 
precursor.  The  dialogue  of  the  deaf  continues,  with  a 
failure  on  each  side  to  appreciate  how  the  other  will 
perceive  statements.  This  includes  a  lack  of  under¬ 
standing  that  policy  taken  as  normal  and  uncontro- 
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versial  in  the  West  can  appear  threatening  in  Russia 
and  in  other  parts  of  the  world  as  well.  For  instance, 
when  Giuseppe  Abbamonte  of  the  European  Commis¬ 
sion's  Directorate  General  for  Communications  Net¬ 
works,  Content  and  Technology  states  publicly  that  a 
key  part  of  the  EU  cyber  security  strategy  is  "engaging 
with  third  parties  and  making  sure  that  we  export  our 
values,"  many  of  those  hearing  him  will  not  take  into 
account  that  substantial  parts  of  the  world  do  not  wish 
to  have  their  values  exported  from  Brussels75  — and, 
in  fact,  precisely  this  kind  of  export  is  construed  as  a 
direct  information  security  threat  in  Russia's  Informa¬ 
tion  Security  Doctrine.76 

The  opposite  also  applies.  Those  following  Rus¬ 
sian  statements  in  the  same  field  have  to  contend  not 
only  with  the  multiple  and  conflicting  sources  of  ap¬ 
parent  policy  initiatives  as  described  previously,  but 
also  with  accompanying  statements,  which  can  leave 
them  disinclined  to  take  what  they  read  seriously  —  as, 
for  instance,  with  the  following  response  to  moves  for 
improved  protection  of  intellectual  property  online: 

Is  the  world  about  to  allow  the  US  and  its  surrogates  to 
come  after  all  of  us?  Apparently  it  is.  The  total  enslave¬ 
ment  of  mankind  will  soon  be  here,  brought  to  you  by 
the  fascist  United  Corporate  States  of  America.77 

It  is  true  that  commentary  in  the  media  should 
not  necessarily  be  taken  as  representative  of  an  of¬ 
ficial  Russian  position,  but  this  point  is  harder  to 
argue  when  the  name  of  the  media  outlet  is  "Voice 
of  Russia." 

The  result  of  this  disconnect  between  radically  dif¬ 
ferent  approaches  to  the  same  issue  can  be  compared 
to  other  areas  of  strategic  contention  between  Russia 
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and  the  Euro-Atlantic  community,  such  as  Russia's 
proposals  for  a  new  European  Security  Treaty  or  Rus¬ 
sian  objections  to  plans  for  basing  missile  defense 
systems  in  and  around  Europe.  In  all  of  these  cases, 
the  Russian  position  is  based  on  considerations  and 
assumptions  that  are  wholly  incompatible  with  reality 
as  the  European  and  North  American  audience  under¬ 
stands  it.  The  result,  in  many  cases,  is  that  what  often 
seems  the  simplest  and  most  appropriate  response  to 
them  is  not  to  engage  with  the  incomprehensible  Rus¬ 
sian  view,  but  simply  to  ignore  it  and  hope  it  will  go 
away.  Unfortunately,  as  can  be  seen  from  the  other 
two  longstanding  examples  given  here,  this  tends  not 
to  happen. 

CONCLUSION 

The  distinctive  Russian  approach  to  what  is  per¬ 
missible,  and  indeed  moral,  in  cyberspace  has  impli¬ 
cations  for  U.S.  policymakers  in  two  key  areas.  First, 
there  is  consideration  of  the  response  to  Russian  and 
similar  proposals  for  international  agreements  gov¬ 
erning  cyberspace.  As  noted,  in  common  with  other 
longstanding  Russian  diplomatic  initiatives,  these 
proposals  will  remain  in  place  regardless  of  whether 
their  audience  sees  them  as  unworkable  or  indeed  in¬ 
comprehensible.  But  unlike  in  previous  years,  it  is  no 
longer  safe  to  broadly  ignore  them,  due  to  the  growing 
alternative  consensus  on  cyber  security  that  opposes 
the  view  of  the  United  States  and  its  close  allies.  Thus, 
if  the  United  States  wishes  to  see  its  own  concept  of 
Internet  freedom  to  remain  the  dominant  one,  the  dip¬ 
lomatic  momentum  that  allowed  a  "formidable"  U.S. 
delegation  to  attend  WCIT  needs  to  be  maintained, 
and  engagement  needs  to  be  fostered  on  a  multilat- 
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eral  basis  to  counter  the  effective  Russian  program  of 
ticking  up  support  for  Moscow's  proposals  from  other 
countries  around  the  world. 

Second,  there  is  the  specific  question  of  when,  or 
whether,  hostile  action  in  cyberspace  constitutes  an  act 
or  state  of  war.  On  this  point,  Russian  thinking  appears 
at  odds  with  the  emerging  Western  consensus.  This 
requires  an  expansion  of  study  of  law  both  within  the 
U.S.  military  and  in  academia  to  include  active  consid¬ 
eration  of  the  view  from  Russia  and  other  dissenting 
nations.  Achieving  direct  dialogue  between  the  U.S. 
and  Russian  militaries,  as  well  as  with  other  agencies 
on  the  Russian  side  that  would  be  engaged  in  cyber 
conflict,  may  be  challenging  but  must  be  attempted. 
Confidence  building  measures  to  avert  cyber  conflict 
can  expand  on  agreements  reached  between  the  Unit¬ 
ed  States  and  Russia  during  June  2013  that  were  "ded¬ 
icated  to  assessing  emerging  ICT  [information  and 
communication  technologies]  threats  and  proposing 
concrete  joint  measures  to  address  them,"78  including 
provision  for  direct  communications  between  national 
community  emergency  response  teams  (CERTs).79 

Finally,  U.S.  policymakers  cannot  afford  to  un¬ 
derestimate  the  extent  to  which  Russian  concepts 
and  approaches  differ  from  what  they  may  take  for 
granted.  For  instance,  much  effort  has  been  devoted 
in  the  West  to  determining  when  a  cyber  weapon  can 
legally  be  used.80  But  when  engaging  in  debate  with 
Russia,  we  must  consider  that  even  the  notion  of  what 
constitutes  a  cyber  weapon— or  in  Russian  terminol¬ 
ogy,  an  information  weapon— will  be  radically  differ¬ 
ent  from  our  assumptions.81  As  put  over  a  decade  ago 
by  the  eminent  scholar  of  Russian  ways  of  thinking 
Timothy  F.  Thomas: 
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What  is  really  different  is  the  conceptual  understand¬ 
ing  of  an  information  operation  from  a  cultural, 
ideological,  historical,  scientific,  and  philosophical 
viewpoint.  Different  prisms  of  logic  may  offer  totally 
different  conclusions  about  an  information  operation's 
intent,  purpose,  lethality,  or  encroachment  on  sover¬ 
eignty;  and  this  logic  may  result  in  new  methods  to 
attack  targets  in  entirely  non-traditional  and  creative 
ways.82 
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